CV0-004 Cloud Architecture and Design Practice Test 12 — 15 Questions

Question 1

A financial services firm runs a latency-sensitive trading application in a public cloud. The security team requires that traffic between the application tier and the database tier never traverse the public internet, that both tiers reside in the same virtual network, and that access to the database be restricted to specific application subnet addresses. Which combination of cloud networking controls should the architect implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place both tiers in the same virtual network and attach a network security group rule to the database subnet allowing only the application subnet CIDR.. Hosting both tiers in a single virtual network guarantees east-west traffic remains on the provider's private network, and a network security group scoped to the database subnet that allows only the application subnet CIDR enforces least-privilege access. Together these controls satisfy the private-path and restricted-access mandates without introducing internet routing or unnecessary tunnel overhead.

Answer

Place the tiers in separate virtual networks and connect them with a site-to-site VPN tunnel over the internet.

Answer

Assign public IP addresses to the database nodes and use a host-based firewall to allow only the application servers.

Answer

Put both tiers in the same virtual network and rely on the default allow-all rules provided by the cloud platform.

Question 2

A cloud administrator is designing a backup strategy for a critical database. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 1 hour. Which backup approach BEST meets these objectives?

Accepted Answer

Enable continuous transaction log shipping to a standby database in another availability zone.. Continuous transaction log shipping provides near-real-time replication, ensuring that the standby database is always up to date. This achieves an RPO of minutes or less, well within the 15-minute requirement. In the event of a failure, the standby can be promoted quickly, meeting the 1-hour RTO. Daily or hourly backups are too infrequent for the RPO, and single-zone redundancy does not provide disaster recovery.

Answer

Take a full backup once a day and store it in a different region.

Answer

Take a snapshot every hour and copy it to object storage.

Answer

Rely on the cloud provider's built-in redundancy within a single availability zone.

Question 3

A cloud engineer is designing a VPC for a web application that requires a public subnet for a load balancer and a private subnet for application servers. The application servers must access the internet for software updates without being directly accessible from the internet. Which configuration should the engineer implement?

Accepted Answer

Create a NAT Gateway in the public subnet and update the private subnet's route table to point to the NAT Gateway.. A NAT Gateway in a public subnet allows private subnet instances to initiate outbound internet traffic while remaining inaccessible from the internet. The private subnet's route table must direct outbound traffic to the NAT Gateway. This is the standard AWS design pattern for enabling updates and patches for private instances without exposing them publicly.

Answer

Attach an Internet Gateway to the VPC and configure the private subnet's route table to point to the Internet Gateway.

Answer

Set up a VPN connection between the VPC and the on-premises data center and route all internet traffic through the VPN.

Answer

Assign Elastic IP addresses to the application servers and configure security groups to allow outbound traffic only.

Question 4

A cloud engineer is designing a disaster recovery strategy for a critical application hosted on Azure. The application uses a SQL Database and must be able to fail over to a secondary region with minimal data loss. The Recovery Point Objective (RPO) is 5 minutes and the Recovery Time Objective (RTO) is 15 minutes. The engineer needs a solution that automatically replicates data and provides a connection endpoint that remains constant during failover. Which Azure feature should be implemented?

Accepted Answer

Azure SQL Database auto-failover groups. Auto-failover groups provide automatic replication and a stable listener endpoint that enables seamless failover to a secondary region. This meets the low RPO and RTO requirements by automating the failover process and abstracting the underlying database changes from the application.

Answer

Azure SQL Database geo-restore

Answer

Azure SQL Database zone-redundant configuration

Answer

Azure SQL Database active geo-replication

Question 5

A healthcare company must ensure that patient records stored in a public cloud are encrypted at rest and that the company alone controls the keys used for encryption, including the ability to revoke access immediately if an employee leaves. Which key management approach BEST satisfies these requirements?

Accepted Answer

Use customer-managed keys stored in a cloud key management service with granular access policies.. Customer-managed keys in a cloud key management service give the healthcare company ownership of the key material and policy-based control over who may use it. Revoking a departing employee's key permissions blocks decryption immediately, and the organization can rotate or disable keys on its own schedule, satisfying both encryption-at-rest and exclusive key custody.

Answer

Enable transport layer security for all connections and rely on it to protect stored patient records.

Answer

Use provider-managed encryption keys that the cloud vendor generates and rotates automatically.

Answer

Encrypt data with a symmetric key hardcoded in the application source code stored in the repository.

Question 6

A company is migrating a legacy application to AWS. The application requires a shared file system that can be mounted on multiple Linux-based EC2 instances simultaneously. The file system must be highly available and scalable, and it must support POSIX permissions. Which AWS service should be used?

Accepted Answer

Amazon EFS. Amazon EFS is the correct choice because it is a managed NFS file system that can be mounted on multiple Linux EC2 instances, supports POSIX permissions, and is highly available and scalable. EBS is block storage for single-instance attachment, S3 is object storage, and FSx for Windows is for Windows workloads.

Answer

Amazon S3

Answer

Amazon EBS

Answer

Amazon FSx for Windows File Server

Question 7

A cloud architect is designing a landing zone in AWS Organizations. The security team mandates that all member accounts must centrally log API activity and that individual account administrators must not be able to disable or alter the log destination. The architect needs to enforce this across every current and future account with minimal operational overhead. Which combination of actions should the architect take?

Accepted Answer

Create an organization trail in CloudTrail from the management account with an S3 bucket in a dedicated log archive account, and attach a service control policy (SCP) denying cloudtrail:StopLogging and cloudtrail:DeleteTrail to all member accounts.. Centralized, tamper-resistant logging across an entire AWS Organization is achieved with an organization trail created from the management account that delivers to a log archive account, combined with an SCP that denies the trail-stopping and trail-deletion actions to member accounts. This design automatically covers future accounts and prevents local administrators from disabling logging.

Answer

Enable CloudTrail in each member account individually, and use AWS Config rules to detect when a trail is stopped so the security team can be notified.

Answer

Enable AWS CloudTrail Lake in the management account and configure an event data store that ingests events from all member accounts through a resource-based policy.

Answer

Configure AWS Control Tower with a detective guardrail that monitors CloudTrail configuration drift and sends findings to Security Hub for remediation.

Question 8

A cloud administrator is deploying a new three-tier application on Google Cloud. The web tier must be accessible from the internet, the application tier must only accept traffic from the web tier, and the database tier must only accept traffic from the application tier. The administrator needs to implement network security controls to enforce these requirements. Which two Google Cloud features should be used? (Choose two.)

Accepted Answer

Network tags on instances. VPC firewall rules and network tags work together to enforce tiered network segmentation. Firewall rules define allowed traffic based on tags, and network tags identify instances belonging to each tier. This combination ensures that only the intended traffic flows between tiers, meeting the security requirements.

Answer

Hierarchical firewall policies

Answer

Cloud Armor security policies

Answer

VPC Service Controls

Question 9

A cloud engineer is designing a microservices architecture on AWS. The services must communicate asynchronously and decouple producers from consumers. The engineer needs a fully managed message queuing service that supports dead-letter queues and message retention up to 14 days. Which AWS service should be used?

Accepted Answer

Amazon SQS. Amazon SQS is the only fully managed message queuing service among the options. It provides asynchronous decoupling, supports dead-letter queues for isolating problematic messages, and allows message retention up to 14 days. SNS is pub/sub, EventBridge is an event bus, and Step Functions is an orchestrator, so they do not meet the specific queuing and retention requirements.

Answer

AWS Step Functions

Answer

Amazon EventBridge

Answer

Amazon SNS

Question 10

A cloud architect is designing a disaster recovery strategy for a mission-critical application hosted in a single cloud region. The business requires that the application survive the loss of an entire region and that failover be largely automated with minimal data loss. The budget permits a warm standby environment. Which TWO design elements should the architect include to meet these requirements? (Choose two.)

Accepted Answer

Deploy a warm standby environment in a second region that can be scaled up on failover.. Surviving a full regional outage with minimal data loss requires both a copy of the data and configuration outside the failed region and a second-region environment ready to take over. Continuous cross-region replication minimizes the recovery point objective, while a warm standby that scales up on failover provides a rapid, largely automated recovery path within the stated budget.

Answer

Rely on manual runbooks to rebuild the environment after a regional outage is detected.

Answer

Store nightly database backups exclusively in the primary region's object storage.

Answer

Configure the application to use a single availability zone within the primary region for lowest latency.

Question 11

A cloud architect is designing a system that must durably store an unlimited amount of unstructured data, such as images and videos, with 99.999999999% (11 nines) durability. The data will be accessed infrequently, but when accessed, it must be available within milliseconds. The architect wants the most cost-effective storage class for this access pattern. Which Amazon S3 storage class should the architect choose?

Accepted Answer

Amazon S3 Standard-Infrequent Access (S3 Standard-IA). Amazon S3 Standard-IA is the correct choice because it provides low-latency access and 11 nines of durability at a lower storage cost than S3 Standard, making it ideal for infrequently accessed data that requires immediate availability. The other options are either too expensive for infrequent access, incur monitoring fees, or have retrieval times that are too slow.

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon S3 Standard

Answer

Amazon S3 Intelligent-Tiering

Question 12

A cloud engineer is sizing a relational database for an application with unpredictable read volume that spikes sharply during business hours. The database must scale read capacity without downtime and without changing the application's connection string. Which approach should the engineer use?

Accepted Answer

Add read replicas behind a database-aware proxy or reader endpoint so reads are distributed across replicas.. Read replicas let a relational database scale read capacity horizontally while the primary continues handling writes. Because replicas can be added or removed online and a reader endpoint or proxy keeps a stable address, the application does not need a new connection string and experiences no downtime during scaling.

Answer

Vertically scale the primary database instance to a larger size during peak hours.

Answer

Enable a multi-AZ standby and direct read queries to the standby instance.

Answer

Increase the database's storage volume size to improve read throughput.

Question 13

A cloud architect is designing a shared file system for a machine learning cluster where multiple Linux virtual machines must read and write the same training data concurrently with POSIX semantics. The workload runs for several weeks and needs high aggregate throughput. Which storage solution should the architect select?

Accepted Answer

A managed network file system that supports concurrent POSIX access and scales throughput with provisioned capacity.. A managed network file system is purpose-built for many clients mounting the same POSIX namespace concurrently. It provides shared file locking and metadata, and its throughput commonly scales with provisioned capacity, making it suitable for a long-running, high-throughput machine learning workload that requires consistent concurrent access.

Answer

An object storage bucket accessed through a REST API for all training data reads and writes.

Answer

A local SSD on each virtual machine with a scheduled rsync job to synchronize data.

Answer

A block storage volume attached to each virtual machine individually.

Question 14

A cloud engineer is deploying a new web application on Google Cloud. The application must be reachable from the internet on HTTP and HTTPS, and the engineer wants Google's global edge network to terminate TLS and route users to the closest healthy backend. The backend instances should not be directly exposed to the internet. Which Google Cloud service should the engineer use?

Accepted Answer

Cloud Load Balancing with an external Application Load Balancer and a managed SSL certificate.. An external Application Load Balancer is the Google Cloud service that provides global Layer 7 load balancing, TLS termination with managed certificates, health-checked routing to the nearest backend, and private backends. Cloud NAT, passthrough network load balancing, and Cloud CDN each address different concerns and cannot fulfill the full set of requirements.

Answer

Cloud CDN with a signed URL configuration pointing directly at the backend instance group.

Answer

A regional external passthrough Network Load Balancer with backend VMs that have public IP addresses.

Answer

Cloud NAT with a regional external IP address, allowing backend instances to serve traffic directly.

Question 15

A cloud architect is designing a solution to store and retrieve large volumes of unstructured data for a media company. The data must be highly durable, available, and accessible from multiple AWS Regions with low latency. The company also wants to minimize costs for data that is infrequently accessed but must be retained for years. Which AWS service and feature combination should the architect use?

Accepted Answer

Amazon S3 with Cross-Region Replication and S3 Lifecycle policies to transition to S3 Glacier Deep Archive. Amazon S3 with Cross-Region Replication and lifecycle policies to S3 Glacier Deep Archive provides a durable, highly available, and globally accessible solution for unstructured data. Cross-Region Replication ensures low-latency access from multiple regions, while lifecycle policies automatically transition infrequently accessed data to a low-cost archival storage class. The other services are either block or file storage and do not offer the same global accessibility and cost-effective archival.

Answer

Amazon FSx for Lustre with data repository integration

Answer

Amazon EBS with snapshots copied to multiple regions

Answer

Amazon EFS with replication to multiple regions